[
https://issues.apache.org/jira/browse/CXF-9108?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Amshika Hameed updated CXF-9108:
--------------------------------
Fix Version/s: 3.5.11
> Resource name passed to Classloader method should not have a leading slash
> --------------------------------------------------------------------------
>
> Key: CXF-9108
> URL: https://issues.apache.org/jira/browse/CXF-9108
> Project: CXF
> Issue Type: Bug
> Components: Core
> Affects Versions: 3.5.9, 3.5.10
> Reporter: Amshika Hameed
> Priority: Critical
> Fix For: 3.5.11
>
>
> In the
> [Version|https://github.com/apache/cxf/blob/3.5.x-fixes/core/src/main/java/org/apache/cxf/version/Version.java]
> class in CXF Core, the ClassLoader's getResourceAsStream method is first
> called using a resource name constructed using the
> [VERSION_BASE|https://github.com/apache/cxf/blob/467e235a9ef4b5cdd39a4312686bfe7c23b0ac45/core/src/main/java/org/apache/cxf/version/Version.java#L32]
> which has a leading slash. If that fails to find the resource, it strips the
> leading slash and makes a second call.
> However, as pointed out by *[markt-asf|https://github.com/markt-asf]* in
> [this
> comment|https://github.com/apache/tomcat/pull/816#issuecomment-2640347996],
> the [Java documentation on using methods of the ClassLoader
> class|https://docs.oracle.com/javase/8/docs/technotes/guides/lang/resources.html?utm_source=chatgpt.com#classloader]
> states that resource names used when calling ClassLoader methods should not
> have a leading slash.
> {quote}The methods in ClassLoader use the given String as the name of the
> resource without applying any absolute/relative transformation (see the
> methods in Class). The name should not have a leading "/".
> {quote}
> Further, the [Java documentation on resource
> names|https://docs.oracle.com/javase/8/docs/technotes/guides/lang/resources.html?utm_source=chatgpt.com#res_names]
> also states,
> {quote}Absolute names are stripped of their starting "/" and are passed,
> without any further modification, to the appropriate {{ClassLoader}} method
> to locate the resource.
> {quote}
> Therefore, ideally, the
> [VERSION_BASE|https://github.com/apache/cxf/blob/467e235a9ef4b5cdd39a4312686bfe7c23b0ac45/core/src/main/java/org/apache/cxf/version/Version.java#L32]
> should not have a leading slash and a single call to the ClassLoader's
> getResourceAsStream method without the leading slash would suffice.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
